Andrew Pizzello, CPA Email me
  1. Home
  2. Security and disclosure

Security and disclosure

How to report a security problem to me, and how I handle the ones I find in other people's software.

  • Andrew Pizzello, CPA
  • Updated October 15, 2026
  • security.txt

Report a problem

Email andrew@andrewpizzello.com with “Security” in the subject line. Tell me what you found, where you found it, how to reproduce it, and what you think the impact is. Please leave anyone's personal or client data out of your report.

I'll acknowledge your report within three business days and keep you posted until it's resolved.

What this policy covers

This policy covers andrewpizzello.com only. The site runs on a hosting provider's shared servers, which I don't own and can't authorize you to test, so keep your testing to the site itself. Please don't test other systems I operate; they hold client information. If you come across a problem in one of them, report it and stop there.

Ground rules

  • Don't access, change, download or keep data that isn't yours. If you come across someone else's information, stop and tell me.
  • Don't degrade the service. No denial of service, load testing or high-volume automated scanning.
  • No social engineering, phishing or physical attempts against me, my clients or anyone I work with.
  • Don't test systems that belong to my clients.
  • Give me a reasonable chance to fix a problem before you disclose it publicly.

Good faith

If you make a good-faith effort to follow this policy while researching andrewpizzello.com, I'll consider that research authorized. I won't pursue or support legal action against you over it, and I'll work with you to understand and fix the problem. If you're unsure whether something is allowed, ask me first.

With your permission, I'll thank you by name once a fix is in place.

When I find a problem in someone else's software

I follow coordinated disclosure:

  • I report it privately to the vendor, through their published security contact when they have one.
  • I give them a reasonable window to fix it, normally 90 days, and longer when they're making progress.
  • I publish details only after a fix is available or the window has passed, and never with client data.

Machine-readable contact

The same contact details are published at /.well-known/security.txt, the standard location defined in RFC 9116.